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. Abstract — Cooperation between wireless network nodes is a 
promising teclinique for improving tlie pliysical layer security of 
wireless transmission, in terms of secrecy capacity, in the presence 
of multiple eavesdroppers. While existing physical layer security 
literature answered the question "what are the link-level secrecy 
capacity gains from cooperation?", this paper attempts to answer 
the question of "how to achieve those gains in a practical decen- 
tralized wireless network and in the presence of a secrecy capacity 
cost for information exchange?". For this purpose, we model the 
physical layer security cooperation problem as a coalitional game 
with non-transferable utility and propose a distributed algorithm 
ifor coalition formation. Through the proposed algorithm, the 
wireless users can autonomously cooperate and self-organize into 
disjoint independent coalitions, while maximizing their secrecy 
capacity taking into account the security costs during information 
exchange. We analyze the resulting coalitional structures, discuss 
'their properties, and study how the users can self-adapt the network 
topology to environmental changes such as mobility. Simulation 
results show that the proposed algorithm allows the users to 
cooperate and self-organize while improving the average secrecy 
capacity per user up to 25.32% relative to the non-cooperative 
case. 

L Introduction 

During the past decade, security in wireless networks has 
been mainly considered at higher layers using various techniques 
such as cryptography. However, with the emergence of ad hoc 
and decentralized networks [1], [2], higher-layer techniques such 
as encryption are complex and hard to implement. Therefore, 
(here has been a recent attention on studying the fundamental 
ability of the physical layer (PHY) to provide secure wireless 
communication. The main idea is to exploit the wireless channel 
PHY characteristics such as fading or noise for improving the 
reliability of wireless transmission. While these characteristics 
have always been seen as impairments, PHY layer security stud- 
ies can utilize these characteristics for improving the security and 
reliability of wireless communication systems. This reliability 
is quantified by the secrecy capacity, which is defined as the 
maximum rate of secret information sent from a wireless node 
to its destination in the presence of eavesdroppers. The study of 
this security aspect began with the pioneering work of Wyner 
over the wire-tap channel [3] which showed that communicating 
data can be done in a secure manner without relying on any 
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form of encryption such as secret keys. This work was followed 
up in [4], [5] for the scalar Gaussian wire-tap channel and the 
broadcast channel, respectively. 

In recent years, there has been a growing interest in carrying 
out these studies unto the wireless and the multi-user channels 
[6-11]. For instance, in [6] and [7], the authors study the secrecy 
capacity region for both the Gaussian and the fading broadcast 
channels and propose optimal power allocation strategies. In 
[8], the secrecy level in multiple access channels from a link- 
level perspective is studied. Further, multiple antenna systems 
have been proposed in [9], [11] for ensuring a non-zero secrecy 
capacity, notably when the channel between the source and the 
destination is worse than the channel between the source and 
the eavesdroppers. Due to the size limitations of mobile devices, 
cooperation has been recently investigated as a practical way to 
achieve the multiple antenna gains [12]. In this context, the work 
in [10] investigates, through a two stage algorithm, the secrecy 
capacity gains (with no cost) resulting from the cooperation 
between a single cluster consisting of one source node and a 
number of relays. In this work, they investigate how a group 
of single antenna users can collaborate, by using beamforming 
(with no cost for cooperation), for improving their secrecy capac- 
ity. Briefly, the majority of the existing literature is devoted to the 
information theoretic analysis of link-level performance gains 
of secure communications with no information exchange cost, 
notably when a source node cooperate with some relays such 
as in [10]. No work seems to have investigated how a number 
of users, each with its own data, can interact and cooperate at 
network-wide level to improve their secrecy capacity and provide 
PHY security for their wireless transmission. 

The main contribution of this work is to propose distributed 
cooperation strategies, through coalitional game theory, which 
allow to study the interactions between a network of users that 
seek to secure their communication through cooperation in the 
presence of multiple eavesdroppers. Another major contribution 
is to study the impact on the network topology and dynamics of 
the inherent trade off that exists between the PHY security co- 
operation gains in terms of secrecy capacity and the information 
exchange costs. In other words, while the earlier work answered 
the question "what are the secrecy capacity gains from coopera- 
tion?", here, we seek to answer the question of "how to achieve 
those gains in a practical decentralized wireless network and in 
the presence of a cost for information exchange?". We model 
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Fig. 1. System Model for Physical Layer Security Coalitional Game. 

the problem as a non-transferable coalitional game and propose a 
distributed algorithm for autonomous coalition formation based 
on well suited concepts from cooperative games. Through the 
proposed algorithm, each user autonomously decides to form or 
break a coalition for maximizing its utility in terms of secrecy 
capacity while accounting for the loss of secrecy capacity 
during information exchange. We show that independent disjoint 
coaUtions form in the network, due to the cooperation cost, and 
we study their properties. Through simulations, we assess the 
performance of the proposed algorithm, investigate the network 
topology, and show how the users can self-organize and adapt the 
topology to mobility. Simulation results show that the proposed 
algorithm allows the users to cooperate and self-organize while 
improving the average secrecy capacity per user up to 25.32% 
relative to the non-cooperative case. 

The rest of this paper is organized as follows: Section 
presents the system model. Section |lll] presents the game for- 
mulation and properties. In Section |IV] we devise the coalition 
formation algorithm. Simulation results are presented and ana- 
lyzed in Section |V] Finally, conclusions are drawn in Section 

II. System Model 

Consider a network having N transmitters (e.g. mobile users) 
sending data to M receivers (destinations) in the presence of K 
eavesdroppers that seek to tap into the transmission of the users. 
Users, receivers and eavesdroppers are unidirectional-single- 
antenna nodes. We define TV = {1, ... , N}, M = {I, . . . , M} 
and K. = {!,..., A'} as the sets of users, destinations, and 
eavesdroppers, respectively. In this work, we consider only 
the case of multiple eavesdroppers, hence, we have K > 1. 
Furthermore, let hi,„i. denote the complex baseband channel 
gain between user i E J\f and its destination G and gi^k 
denote the channel gain between user i E J\f and eavesdropper 
k E JC. We consider a line of sight channel model with 



hi 



with dj 



the distance between user i 



and its destination m;, fi the pathloss exponent, and ^i.m; the 
phase offset. A similar model is used for the user-eavesdropper 
channel. 

For multiple access, we consider a TDMA transmission, 
whereby, in a non-cooperative manner, each user occupies a 



single time slot. Within a single slot, the maximum amount 
of reliable information transmitted from the user i occupying 
the slot to its destination rrii is quantified through the secrecy 
capacity Ci,„n defined as follows [6]: 



Ci. 



max Cfi, 

l<k<K ■ 



(1) 



where Cf„ is the Shannon capacity for the transmission 
between user i and its destination rrii G M, C^^, is the 
Shannon capacity of user i at the eavesdropper k E IC, and 
a+ = max {a, 0). 

In a non-cooperative approach, due to the broadcast nature of 
the wireless channel, the transmission of the users can be over- 
heard by the eavesdroppers which reduces their secrecy capacity 
as clearly expressed in ([T]). For improving their performance 
and increasing their secrecy capacity, the users can collaborate 
by forming cooperative groups known as coalitions. Within 
every coalition, the users can utilize collaborative beamforming 
techniques for improving their secrecy capacities. In this context, 
every user i belonging to a coalition S will use the cooperation 
protocol of [10] by dividing its slot into two durations: 

1 ) In the first duration, user i broadcasts its information to the 
other members of coalition S. 

2) In the second duration, coalitions S performs collaborative 
beamforming. In other words, all the members of coalition 
S relay a weighted version of user is signal to its destina- 
tion. 

The objective of this cooperation is to null the signal at the 
eavesdroppers, i.e., impose C![^. = 0,Vfc G /C, hence, improving 
the secrecy capacity in dU [10]. Each coalition S C J\f that 
forms in the network is able to transmit within all the time slots 
previously held by its users. Thus, in the presence of cooperating 
coalitions, the TDMA system schedules one coalition per time 
slot. During a given slot, the coalition acts as a single entity 
for transmitting the data of the user that owns the slot. An 
illustration of this model is shown in Figure [T] for N = 9 users, 
M = 2 destinations, and K = 2 eavesdroppers. 

Furthermore, we define a fixed transmit power per time slot P 
which constrains all the users that are transmitting within a given 
slot. In a non-cooperative manner, this power constraint applies 
to the single user occupying the slot, while in a cooperative 
manner this same power constraint applies to the entire coalition 
occupying the slot. Such a power assumption is typical in 
TDMA systems comprising mobile users and is a direct result 
of ergodicity and the time varying user locations [12-14]. For 
every coalition S, during the time slot owned by user i E S, 
user i utilizes a portion of the available power P for information 
exchange (first stage) while the remaining portion Pf is used by 
the coalition S to transmit the actual data to the destination rrii of 
user i (second stage). For information exchange, user i G S* can 
broadcast its information to the farthest user i G 5, by doing so 
all the other members of S can also obtain the information due 
to the broadcast nature of the wireless channel. This information 



exchange incurs a power cost j given by 

^2 



9i. 



(2) 



where vq is a target average signal-to-noise ratio (SNR) for 
information exchange, a'^ is the noise variance and q^i ~ I /d^~^ 

is the path loss between users i and i with the distance 
between them. The remaining power that coalition S utilizes for 
the transmission of the data of user i during the remaining time 
of this user's slot is 



Pf^iP-P 



(3) 
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For every coalition S, during the transmission of the data 
of user i to its destination, the coalition members can weigh 
their signals in a way to completely nidi the signal at the 
eavesdroppers. We define, for a coalition S, the jS*] x 1 vectors 

= Ki , • ■ • , Wi| 

destination" channels, "user-eavesdropper k" channels, and the 
signal weights. By nulling the signals at the eavesdropper 
through cooperation within coalition S, the secrecy capacity ([T]i 
achieved by user i e 5* at its destination 7ti,; during user i's time 
slot becomes [10, Eq. (14)] 



[.9ii,fc, ■ • ■ ,5i|s|,fc] ' and 
]^ which represent, respectively, the "user- 



(4) 



where Rs ~ hshg , is the noise variance, and w"J'^ is the 
weight vector that maximizes the secrecy capacity while nulling 
the signal at the eavesdropper and is given in [10, Eq.(20)] by 



opt • 



wT = (3fG^{GsG^)-'e with G5 = [hs,g h...,g§ 
a (A' + 1) X |5| matrix, /3f = W „ "^g, ^ a scalar and 



eff(GsGf)-ie 

e = [l,Oixif]-^ a {K + 1) X 1 vector. In ©, the factor i 
accounts for the fact that half of the slot of user i is reserved 
for information exchange. 

Having adequately presented the model for physical layer 
security, the remainder of this paper is devoted to investigate 
how a network of users can cooperate, through the protocol 
described in this section, and improve the security of their 
wireless transmission, i.e., their secrecy capacity. 

III. Physical Layer Security as A Coalitional Game 

In this section, we formulate the physical layer security model 
of the previous section as a coalitional game and we investigate 
its properties. For instance, the proposed PHY security problem 
is modeled as a coalitional game with a non-transferable utility 
defined as [15]; 

Definition 1: A coalitional game with non-transferable utility 
is defined by a pair (A/", V) where TV is the set of players and 
F is a mapping such that for every coalition S C J\f, V{S) is 
a closed convex subset of M''^' that contains the payoff vectors 
that players in S can achieve. 

For the proposed physical layer security problem, given a 
coalition S and denoting by 4>i{S) the payoff of user i E S 



during its time slot, we define the coalitional value set, i.e., the 
mapping V as follows 

V{S) = {cj,{S) e Rl'^l| \/ieS ^S) = {v^S) - c,(5))+ 
if Pf > 0, and = -00 otherwise.}, 

(5) 

where Vi{S) = Cfj^. is the gain in terms of secrecy capacity 
for user i e S given by dU while taking into account the 
available power Pf in ^ and Ci{S) is a secrecy cost function 
that captures the loss for user i S 5, in terms of secrecy capacity, 
that occurs during information exchange. Note that, when all 
the power is spent for information exchange, the payoff 4ii{S) 
of user i is set to —00 since, in this case, the user has clearly 
no interest in cooperating. 

With regard to the secrecy cost function Ci{S), when a 
user i E S sends its information to the farthest user i £ 5 
using a power level P^ the eavesdroppers can overhear the 
transmission. This security loss is quantified by the capacity at 
the eavesdroppers resulting from the information exchange and 
which, for a particular eavedropper fc G /C, is given by 



(6) 



Given this security loss, the cost function c{S) can be defined 

as 

Q(5) = max(qi,...,q^). (7) 

In a nutshell, the proposed coalitional value defined in (|5]) 
considers the benefit from cooperation, in terms of improved 
secrecy capacity, while taking into account the costs in terms of 
reduced power for transmission due to the power fraction used 
for information exchange as well as the secrecy capacity loss 
due to the eavesdroppers overhearing the transmission of the 
users during the information exchange phase. 

Subsequently, the proposed physical layer security coopera- 
tion problem can be easily formulated as a coalitional game 
with non-transferable utility as per the following property: 

Property 1: Given the mapping V in Q, whenever the users 
transmit at their maximum rate (i.e. capacity), the proposed PHY 
security cooperation problem is a (A/^, V) non-transferable utility 
coalitional game. 

Proof: Immediate result from the fact that when the users 
transmit at their maximum rate, the mapping V{S) defined in (|5]l 
is a singleton set, and hence, closed and convex. Consequently, 
the proposed coalitional game model has a non-transferable 
utility V{S) expressed by (|5]l ■ 

In general, coalitional game based problems seek to charac- 
terize the properties and stability of the grand coalition of all 
players since it is generally assumed that the grand coalition 
maximizes the utilities of the players [15]. In our case, although 
cooperation improves the secrecy capacity for the users in the 
TDMA network; the costs in terms of: 

1) The fraction of power spent for information exchange as 
per (O and, 

2) the secrecy loss during information exchange as per (|7]i 



strongly limit the cooperation gains. Therefore, for the proposed 
(TV, v) coalitional game we have: 

Property 2: For the proposed {Af, V) coalitional game, the 
grand coalition of all the users seldom forms due to the various 
costs for information exchange. Instead, disjoint independent 
coalitions will form in the network. 

Proof: Given a number of users positioned at different 
location within the wireless network, cooperation for improving 
the secrecy capacity entails costs, as previously mentioned, 
in terms of secrecy loss and power loss during information 
exchange as per (|2]i and (|7|i. Hence, in a practical wireless 
network where the users are located at different positions, it is 
highly likely that, when they attempt to cooperate for forming 
the grand coalition A/" of all users, either: (i)- there exists a 
pair of users i,j G Af that are distant enough to require an 
information power cost of P hence they have no incentive to 
join the grand coalition, or (ii)- there exists a user i G Af with 
the payoff of i in the grand coalition 4>i{A/) = due to the 
secrecy loss as captured by (|7]), hence this user i has incentive 
to deviate from the grand coalitions. Clearly, by accounting for 
the various cooperation costs, the grand coalition of all users 
will seldom form (it only forms if all users are very close, which 
is unrealistic in a large scale wireless network) and hence, the 
network structure consists of disjoint independent coalitions. ■ 

Due to this property, traditional solution concepts for coali- 
tional games, such as the core [15], may not be applicable. 
In fact, in order for the core to exist, as a solution concept, 
a coalitional game must ensure that the grand coalition, i.e., the 
coalition of all players will form. However, as seen in Figure [T] 
and corroborated by Property [21 in general, due to the cost for 
coalition formation, the grand coalition will not form. Instead, 
independent and disjoint coalitions appear in the network as a 
result of the collaborative beamforming process. In this regard, 
the proposed game is classified as a coalition formation game, 
and the objective is to find the coalitional structure that will form 
in the network, instead of finding only a solution concept, such 
as the core, which aims mainly at stabilizing the grand coalition. 

Furthermore, for the proposed (A/", V) coalition formation 
game, a constraint on the coalition size, imposed by the nature 
of the cooperation protocol exists as follows: 

Remark 1: For the proposed {Af, V) coalition formation 
game, the size of any coalition S C Af that will form in the 
network must satisfy IS"! > K. 

This is a direct result of the fact that, for nulling K eaves- 
droppers, at least K + 1 users must cooperate, otherwise, no 
weight vector can be found to maximize ([T]) while nulling the 
signal at the eavesdroppers. 

IV. Distributed Coalition Formation Algorithm 
A. Coalition Formation Algorithm 

Coalition formation has been a topic of high interest in game 
theory [16-19]. The goal is to find algorithms for characterizing 
the coalitional structures that form in a network where the grand 
coaUtion is not optimal. For instance, using game theoretical 



techniques from coalition formation games, we devise an algo- 
rithm for distributed coalition formation algorithm in the pro- 
posed {A/, V) PHY security cooperative game. For constructing 
a coalition formation process suitable to the proposed game, we 
require the following definitions [18] 

Definition 2: A collection of coalitions, denoted by S, is 
defined as the set S = {S*!, . . . , S*;} of mutually disjoint 
coalitions Si C A/. In other words, a collection is any arbitrary 
group of disjoint coalitions Si of Af not necessarily spanning all 
players of Af. If the collection spans all the players of Af; that 
is Uj=i '^j = the collection is a partition of Af. 

Definition 3: A preference operator or comparison relation 
\> is an order defined for comparing two collections TZ = 
{Ri, . . . ,Ri} and S = {Si, . . . , Sp} that are partitions of the 
same subset A'^ Af (i.e. same players in TZ and S). Therefore, 
TZl> S implies that the way TZ partitions A is preferred to the 
way S partitions A. 

Various well known orders can be used as comparison re- 
lations in different scenarios [18], [19]. These orders can be 
divided into two main categories: coalition value orders and 
individual value orders. Coalition value orders compare two col- 
lections (or partitions) using the value function of the coalitions 
inside these collections (suitable for games with transferable 
utilities) while individual value orders perform the comparison 
using the individual payoffs of every user For the individual 
orders, two collections TZ and S are seen as two vectors of 
individual payoffs of the same length (corresponding to the 
total number of players) where each element of these payoff 
vectors corresponds to the utility received by the players in each 
coalition Ri G TZ and Si e S. In this context, individual value 
orders are quite suitable for non-transferable utility games such 
as the proposed game. Hence, for the PHY security coalition 
formation game, we define the following individual order that 
will be used in the coalition formation algorithm 

Definition 4: Consider two collections TZ ~ {Ri, . . . , Ri} 
and S = {Si, ... , Sm} that are partitions of the same subset 
A Af (same players in TZ and S). For a collection TZ = 
{Ri, . . . ,Ri}, let the utility of a player j in a coalition Rj G TZ 
be denoted by ^j{TZ) = (j>j{Rj) G V{Rj). TZ is preferred over 
S by Pareto order, written as TZt> S, iff 

TZl>S ^ > V j G TZ, S}, 

with at least one strict inequality (>) for a player k. 

In other words, a collection is preferred by the players over 
another collection, if at least one player is able to improve 
its payoff without hurting the other players. Subsequently, for 
performing autonomous coalition formation between the users 
in the proposed PHY security game, we construct a distributed 
algorithm based on two simple rules denoted as "merge" and 
"spht" [18] defined as follows. 

Definition 5: Merge Rule - Merge any set of coalitions 
{^i, . . . , S";} whenever the merged form is preferred by the 
players, i.e., where 

I 

{\JS,}i>{Si,...,Si}, 



TABLE I 

One round of the proposed PHY security coalition formation 

ALGORITHM 

Initial State 

The network is partitioned by T = {Ti , . . . , Tj; } (At tlie beginning 
of all time T = Af = {1, . . . , N} with non-cooperative users). 
Three phases in each round of the coalition formation algorithm 
Phase 1 - Neighbor Discovery: 

a) Each coalition surveys its neighborhood for candidate partners. 

b) For every coalition Ti, the candidate partners lie in the area 
represented by the intersection of \Ti \ circles with centers j S Ti 
and radii determined by the distance where the power for 
information exchange does not exceed P for any user 

(easily computed through (2)). 
Phase 2 - Adaptive Coalition Formation: 

In this phase, coalition formation using merge-and-spUt occurs, 
repeat 

a) = Merge(T); coalitions in T decide to merge based on 
the algorithm of Section IIV-AI 

b) T = Split(jF); coalitions in decide to split based on 
the Pareto order. 

until merge-and-split terminates. 
Phase 3 - Secure Transmission: 

Each coalition's users exchange their information and transmit 
their data within their allotted slots. 
The above three phases are repeated periodically during the 
network operation, allowing a topology that is adaptive to en- 
vironmental changes such as mobiUty. 



therefore, {Si,...,Si}^ {U'=i Sj}. 

Definition 6: Split Rule - Split any coalition Uj=i '^j when- 
ever a split form is preferred by the players, i.e., where 

I 

{S^,...,Si}t>{\JS,}, 

J=l 

thus, {U]=iSj}^{Si,...,S,}. 

Using the above rules, multiple coalitions can merge into a 
larger coalition if merging yields a preferred collection based 
on the Pareto order This implies that a group of users can 
agree to form a larger coalition, if at least one of the users 
improves its payoff without decreasing the utilities of any of the 
other users. Similarly, an existing coalition can decide to split 
into smaller coalitions if splitting yields a preferred collection 
by Pareto order The rationale behind these rules is that, once 
the users agree to sign a merge agreement, this agreement can 
only be broken if all the users approve. This is a family of 
coalition formation games known as coalition formation games 
with partially reversible agreements [16]. Using the rules of 
merge and split is highly suitable for the proposed PHY security 
game due to many reasons. For instance, each merge or split 
decision can be taken in a distributed manner by each individual 
user or by each already formed coalition. Further, it is shown 
in [18] that any arbitrary iteration of merge and split rules 
terminates, hence these rules can be used as building blocks 
in a coalition formation process for the PHY security game. 

Accordingly, for the proposed PHY security game, we con- 
struct a coalition formation algorithm based on merge-and-split 



and divided into three phases: neighbor discovery, adaptive 
coalition formation, and transmission. In the neighbor discovery 
phase (Phase 1), each coalition (or user) surveys its environment 
in order to find possible cooperation candidates. For a coalition 
Sk the area that is surveyed for discovery is the intersection 
of \Sk\ circles, centered at the coalition members with each 
circle's radius given by the maximum distance (for the circle 
centered at i S Sk) within which the power cost for user 
i as given by Q does not exceed the total available power 
P. This area is determined by the fact that, if a number of 
coalitions {S*!, . . . , Sm} attempt to merge into a new coalition 
G = U^iSi which contains a member i E G such that the 
power for information exchange needed by i exceeds P, then 
the payoff of i goes to — oo as per (|5]i and the Pareto order can 
never be verified. Clearly, as the number of users in a coalition 
increases, the number of circles increases, reducing the area 
where possible cooperation partners can be found. This implies 
that, as the size of a coalition grows, the possibility of adding 
new users decreases, and hence, the complexity of performing 
merge also decreases. 

Following Phase 1, the adaptive coalition formation 
phase (Phase 2) begins, whereby the users interact for assessing 
whether to form new coalitions with their neighbors or whether 
to break their current coalition. For this purpose, an iteration of 
sequential merge-and-split rules occurs in the network, whereby 
each coalition decides to merge (or split) depending on the utility 
improvement that merging (or splitting) yields. Starting from an 
initial network partition T = {Ti, . . . ,T/} of J\f, any random 
coalition (individual user) can start with the merge process. The 
coalition Ti £ T which debuts the merge process starts by 
enumerating, sequentially, the possible coalitions, of size greater 
than K (Remark 1), that it can form with the neighbors that 
were discovered in Phase 1. On one hand, if a new coalition 
Ti which is preferred by the users through Pareto order is 
identified, this coalition will form by a merge agreement of all 
its members. Hence, the merge ends by a final merged coalition 
jnfinai composed of Ti and one or several of coalitions in its 
vicinity. On the other hand, if Ti is unable to merge with any 
of the discovered partners, it ends its search and Tj^"^^ = Ti. 

The algorithm is repeated for the remaining Ti G T until all 
the coalitions have made their merge decisions, resulting in a 
final partition JF. Following the merge process, the coalitions in 
the resulting partition JT are next subject to split operations, 
if any is possible. In the proposed PHY security problem, 
the coalitions are only interested in splitting into structures 
that include either singleton users or coalitions of size larger 
than K or both (Remark 1). Similar to merge, the split is 
a local decision to each coalition. An iteration consisting of 
multiple successive merge-and-split operations is repeated until 
it terminates. The termination of an iteration of merge and split 
rules is guaranteed as shown in [18]. It must be stressed that the 
merge or split decisions can be taken in a distributed way by 
the users/coalitions without relying on any centralized entity. 

In the final transmission phase (Phase 3), the coalitions 
exchange their information and begin their secure transmission 



towards their corresponding destinations, in a TDMA manner, 
one coalition per slot. Every slot is owned by a user who 
transmits its data with the help of its coalition partners, if that 
user belongs to a coalition. Hence, in this phase, the user perform 
the actual beamforming, while transmitting the data of every user 
within its corresponding slot. Each run of the proposed algorithm 
consists of these three phases, and is summarized in Table U As 
time evolves and the users, eavesdroppers and destinations move 
(or new users or eavesdroppers enter/leave the network), the 
users can autonomously self-organize and adapt the network's 
topology through appropriate merge-and-split decisions during 
Phase 2. This adaptation to environmental changes is ensured 
by enabling the users to run the adaptive coalition formation 
phase periodically in the network. 

The proposed algorithm in Table H] can be implemented in 
a distributed manner. As the user can detect the strength of 
other users' uplink signals (through techniques similar to those 
used in the ad hoc routing discovery), nearby coalitions can be 
discovered in Phase 1. In fact, during Phase 1, each coalition 
in the network can easily work out the area within which 
candidates for merge can be found, as previously explained in 
this section. Once the neighbors are discovered, the coalitions 
can perform merge operations based on the Pareto order in 
Phase 2. Moreover, each formed coalition can also internally 
decides to split if its members find a split form by Pareto order 
By using a control channel, the distributed users can exchange 
some channel information and then and then cooperate using our 
model (exchange data information if needed, form coalition then 
transmit). Note that, in this paper, we assume that the users have 
perfect knowledge of the channels to the eavesdroppers which is 
an assumption used in most PHY security related literature, and 
as explained in [10] this channel information can be obtained 
by the users through a constant monitoring of the behavior of 
the eavesdroppers. 

B. Partition Stability 

The result of the proposed algorithm in Table U is a network 
partition composed of disjoint independent coalitions. The sta- 
bility of this network partition can be investigated using the 
concept of a defection function [18]. 

Definition 7: A defection function E) is a function which 
associates with each partition T of TV a group of collections 
in J\f. A partition T = {Ti, . . . , T;} of A/" is B-stable if no 
group of players is interested in leaving T when the players 
who leave can only form the collections allowed by D. 

We are interested in two defection functions [17-19]. First, 
the function which associates with each partition T of JV 
the group of all partitions of JV that can form through merge or 
split and the Be function which associates with each partition 
T of M the group of all collections in M. This function allows 
any group of players to leave the partition T of N through any 
operation and create an arbitrary collection in M. Two forms 
of stability stem from these definitions: Ohp stability and a 
stronger Dc stability. A partition T is D/jp-stable, if no player 
in T is interested in leaving T through merge-and-split to form 



other partitions in M\ while a partition T is Dc-stable, if no 
player in T is interested in leaving T through any operation 
(not necessarily merge or split) to form other collections in M. 

Hence, a partition is D/^p-stable if no coalition has an incentive 
to split or merge. For instance, a partition T — {Ti, . . . , T;} 
is D/jp-stable, if the following two necessary and sufficient 
conditions are met [18], [17] (i;;^ is the non-preference operator, 
opposite of l>): 

1) For each i G {!,..., jti} and for each partition 

. . . , i?™} of T,eT we have 

{Ri,...,R„,}f^T,; (8) 

2) For each S C {!,...,?} we have 

IJt, ^ {r,|ie5}, (9) 

les 

The above conditions are the generalized form (through the 
framework of [18]) of the 'Dhp stability conditions presented 
in [17]. Using this definition of D^p stability, we have 

Theorem 1: Every partition resulting from our proposed 
coalition formation algorithm is D;ip-stable. 

Proof: Consider a partition T resulting from the con- 
vergence of an iteration of merge-and-split operations such 
as in the algorithm of Table H] then no coalition in T can 
leave this partition through merge or split. For instance, assume 
T = {Ti, . . . ,T/} is the partition resulting from the proposed 
merge-and-split algorithm. If for any i E {1, . . . ,1} and for any 
partition {S*!, . . . , S,n} of Ti we assume that {S*!, . . . , S„i}l>Ti 
then the partition T can still be modified through the application 
of the split rule on Ti contradicting with the fact that T resulted 
from a termination of the merge-and-split iteration; therefore 
{Si,...,Sm} ^ Ti (first D/ip stability condition verified). A 
similar reasoning is applicable in order to prove that T verifies 
the second condition; since otherwise a merge rule would still 
be applicable. ■ 

Furthermore, a Dc-stable partition T is characterized by 
being a strongly stable partition, which satisfies the following 
properties: 

1) A Dc-stable partition is D/jp-stable. 

2) A Dc-stable partition is a unique outcome of any iteration 
of merge-and-split. 

3) A Dc-stable partition T is a unique [>-maximal partition, 
that is for all partitions T' of M,T l> T'. In the case 
where \> represents the Pareto order, this implies that the 
Dc-stable partition T is the partition that presents a Pareto 
optimal utility distribution for all the players. 

Clearly, it is desirable that the network self-organizes unto 
a Dc-stable partition. However, the existence of a Dc-stable 
partition is not always guaranteed [18]. The Dc-stable partition 
T = {Ti, . . . ,T;} of the whole space N exists if a partition 
of Af that verifies the following two necessary and sufficient 
conditions exists [18]: 
1) For each i e {1, . . . , Z} and each pair of disjoint coalitions 
Si and 52 such that {Si U C T, we have {5*1 U 5*2} > 
{81,82}. 
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Fig. 2. A snapshot of a coalitional structure resulting from our proposed coalition 
formation algorithm for a network with A'^ = 15 users, M = 2 destinations and 
K = 2 eavedroppers. 

2) For the partition T = {Ti, . . . , TJ a coalition G C J\f 
formed of players belonging to different T!; e T is T- 
incompatible if for no i e {1, . . . ,1} we have G C Ti. 

In summary, Bc-stability requires that for all T-incompatible 
coalitions {G}[T] o {G} where {G}[T] = {G n V i S 
{1, . . . , Z}} is the projection of coalition G on T. If no partition 
of TV can satisfy these conditions, then no Dc-stable partition of 
Af exists. Nevertheless, we have 

Lemma 1: For the proposed {JV, v) PHY security coalitional 
game, the proposed algorithm of TableUconverges to the optimal 
Dc-stable partition, if such a partition exists. Otherwise, the final 
network partition is D^p-stable. 

Proof: The proof is a consequence of Theorem 1 and 
the fact that the Dc-stable partition is a unique outcome of 
any merge-and-split iteration [18] which is the case with any 
partition resulting from our algorithm. ■ 

Moreover, for the proposed game, the existence of the Dc- 
stable partition cannot be always guaranteed. For instance, for 
verifying the first condition for existence of the Bc-stable parti- 
tion, the users that are members of each coalitions must verify 
the Pareto order through their utility given by (|5]l. Similarly, for 
verifying the second condition of Dc stability, users belonging 
to all T-incompatible coalitions in the network must verify 
the Pareto order. Consequently, the existence of such a Dc- 
stable partition is strongly dependent on the location of the 
users and eavesdroppers through the individual utilities (secrecy 
capacities). Hence, the existence of the Dc-stable partition is 
closely tied to the location of the users and the eavesdroppers, 
which, in a practical ad hoc wireless network are generally 
random. However, the proposed algorithm will always guarantee 
convergence to this optimal Dc-stable partition when it exists 
as stated in Lemma I. Whenever a Dc-stable partition does 
not exist, the coalition structure resulting from the proposed 
algorithm will be D/jp-stable (no coalition or individual user 
is able to merge or split any further). 
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Fig. 3. Self-adaptation of the network's topology to mobility as User 12 in 
Figure |2] moves horizontally on the negative x-axis. 

V. Simulation Results and analysis 

For simulations, a square network of 2.5 km x 2.5 km 
is set up with the users, eavesdroppers, and destinations ran- 
domly deployed within this arccQ. In this network, the users 
are always assigned to the closest destination, although other 
user-destination assignments can be used without any loss of 
generality in the proposed coalition formation algorithm. The 
simulation parameters used are as follows. First, the power 
constraint per slot is P = 10 mW, the noise level is —90 dBm, 
and the SNR for information exchange is = 10 dB which 
implies a neighbor discovery circle radius of 1 km per user. For 
the channel model, the propagation loss is set to a = 3. 

In Figure |2l we show a snapshot of the network structure 
resulting from the proposed coalition formation algorithm for a 
randomly deployed network with iV = 15 users, AI — 2 destina- 
tions, and K — 2 eavesdroppers. This figure shows how the users 
self-organize into 6 coalitions with the size of each coalition 
larger than K or equal to 1. For example. Users 4 and 15, having 
no suitable partners for forming a coalition of size larger than 2, 
do not cooperate. The coalition formation process is a result of 
Pareto order agreements for merge (or split) between the users. 
For example, coalition {5,8, 10, 13} formed since all the users 
agree on its formation due to the fact that ^({5, 8, 10, 13}) = 
{^({5,8,10,13}) = [0.356 0.8952 1.7235 0.6213]} which is 
a clear improvement on the non-cooperative utility which was 
for all four users (due to proximity to eavesdropper 2). In a 
nutshell, this figure shows how the users can self-organize into 
disjoint independent coalition for improving the PHY security 
of their wireless transmission. 

In Figure [3] we show how the algorithm handles mobility 
through appropriate coalition formation decisions. For this pur- 
pose, the network setup of Figure |2| is considered while User 

'This general network setting simulates a broad range of network types 
ranging from ad hoc networks, to sensor networks, WLAN networks as well 
as broadband or cellular networks. 



1.8 
1.75 
1.7 



-Cooperation with coalitions 
- Non-cooperative 




■V — ^-V — V — 



5 10 15 20 25 30 35 40 45 

Number of users (N) 

Fig. 4. Performance in terms of tlie average individual user utility (secrecy 
capacity) as a function of the network size for M = 2 destinations and 
K = 2 eavesdroppers. 

12 is moving horizontally for 1.1 km in the direction of the 
negative x-axis. First of all. User 12 starts getting closer to its 
receiver (destination 2), and hence, it improves its utility. In 
the meantime, the utilities of User 12's partners (Users 3 and 
11) drop due to the increasing cost. As long as the distance 
covered by User 12 is less than 0.2 km, the coalition of Users 
1 and 6 can still bring mutual benefits to all three users. After 
that, splitting occurs by a mutual agreement and all three users 
transmit independently. When User 12 moves about 0.8 km, it 
begins to distance itself from its receiver and its utility begins to 
decrease. When the distance covered by User 12 reaches about 
1 km, it will be beneficial to Users 12, 4, and 15 to form 
a 3-user coalition through the merge rule since they improve 
their utilities from 04({4}) = 0.2577, (I>i2{{l2}) = 0.7638, and 
015 ({15}) = in a non-cooperative manner to y ({4, 12, 15}) = 
{^({4, 12, 15}) = [1.7618 1.0169 0.6227]}. 

In Figure H] we show the performance, in terms of average 
utility (secrecy capacity) per user, as a function of the network 
size TV. The results are averaged over the random positions of 
the users, eavesdroppers and destinations. For cooperation with 
coalitions, the average individual utility increases with the num- 
ber of users. This is interpreted by the fact that as the number of 
users increases, the probability of finding candidate partners 
to form coalitions with increases for every user In contrast, for 
the non-cooperative approach an almost constant performance is 
noted. Finally, as easily seen in Figure |4] cooperation presents 
a clear performance advantage at all network sizes reaching 
up to 25.32% improvement of the average user utility (secrecy 
capacity) at A^ = 45. 

VI. Conclusions 

In this paper, we study the user behavior, topology, and 
dynamics of a network of users that interact in order to improve 
their secrecy capacity through cooperation. We formulate the 



problem as a non-transferable coalitional game, and propose a 
distributed and adaptive coalition formation algorithm. Through 
the proposed algorithm, the mobile users can autonomously take 
the decision to form or break cooperative coalitions through well 
suited rules from cooperative games while maximizing their se- 
crecy capacity taking into account various costs for information 
exchange. We characterize the network structure resulting from 
the proposed algorithm, study its stability, and analyze the self- 
adaptation of the topology to environmental changes such as 
mobility. Simulation results show that the proposed algorithm 
allows the users to self-organize while improving the average 
secrecy capacity per user up to 25.32% relative to the non- 
cooperative case. 
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